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FD-192 


07/13/05 
15:26:40 


Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: Source from which Property Acquired: 


12/16/1998 


ICMIPRO1L 
Page 1 


Anticipated Disposition: —— a Case aaa 


=a of Property: 


ITEMS FROM ROOM #4: 
(1) ONE SHEET EDUCATED GUIDE TO SPEEDING TICKETS; 


Date Entered 


b3 


(2) 14 VOLUMES OF 2600 HACKER QUARTERLY; b6 
(3) ONE HACKING FREQUENTLY ASKED QUESTIONS; b7C 
(4) "BLACK LISTED 411" VOLUMES; biz 
(5) ONE FIREWALLS AND INTERNET SECURITY WITH BOOKMARK 
CONTAINING HANDWRITTEN PAGE 
PLEX CELL SYN"; 
(6) RECORDS FROM TOP DRAWER OF TWO DRAWER CABINET; 
(7) RECORDS AND DOCUMENTS FROM BOTTOM DRAWER OF TWO DRAWER 
CABINET 
Barcode: E03841215 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7c 
Case Number: nee 


Owning Office: LOS ANGELES 


FALE COBY 
WBS | 


“ 


07/13/05 ICMIPROL 
15:26:43 FD-192 Page 1 
Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: j ired: 
b6 
12/16/1998 : bie 
Anticipated Disposition: a ne Case ete 
(a (in of Property: Date Entered 
b3 
b6 
ITEMS FROM ROOM #4: bic 
(1) ONE BAG OF OLD MOVIE TICKETS; oe 
(2) ONE PIN 
(3) VARIOUS DOCUMENTS : 
A) NEWSPAPER CLIPPING-DUMPSTER DIVING; 
B) BUSINESS CARDS; 
c)[L__________—*'”TJWs DIAGRAMS/LETTERS; 
E) CREDIT CARD STATEMENTS; 
H)L id SOB/WORK FOLDER; 
K) BOOK "SECRETS OF A SUPER HACKER"; 
L) WHITE THREE RING BINDER,[ ______], "ESS SWITCH" 
Barcode: E03841203 Location: ECR1 P48 12/17/1998 
ITEMS FROM ROOM #4: 
(3) VARLOUS DOCUMENTS : 
DOCUMENTS ; b6 
; PROMISSORY Note. ] b7c 
TAX REPORT; 
D ONE BLACK NOTEBOOK (THREE RING BINDER) ; 
J) TWO BLUE NOTEBOOKS (SPIRAL) ; 
M) BLACK SPIRAL NOTEBOOK BELONGING To[__| 
Barcode: E03826242 Location: ECR1 S6 06/28/2005 
Case Number: b3 
Owning Office: LOS ANGELES b6 
b7C 


b7E 


- 


j | @ @ 


06/28/05 ICMIPRO1 
16:43:54 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: Source from which Property Acquired: 
12/16/1998 Pe 
/ / b7C 
Anticipated Disposition: cas me Case i 
i aml ii of Property: Date Entered 
ITEMS FROM ROOM #4: 
(1) ONE BAG OF OLD MOVIE TICKETS; 
(2) ONE PIN 
(3) VARIOUS DOCUMENTS : 
A) NEWSPAPER CLIPPING-DUMPSTER DIVING; 
_B) BUSINESS CARDS; 
c) CL ) « DIAGRAMS/LETTERS ; 
E) CREDIT CARD STATEMENTS; oa 
H) CL JOB/WORK FOLDER; a 
K) BOOK "SECRETS OF A SUPER HACKER"; nae 
L) WHITE THREE RING BINDER,[_———=éd’SC§ ESS’: SWITCH" ae 
Barcode: E03691519 Location: ECR1 P119 12/17/1998 
ITEMS FROM ROOM #4: 
(3) VARIOUS DOCUMENTS : 
D) L____]Documents; 2 
F) PROMISSORY NOTE, ] 
G) [____] TAX REPORT; 
I) ONE BLACK NOTEBOOK (THREE RING BINDER) ; 
J) TWO BLUE NOTEBOOKS (SPIRAL) ; 
M) BLACK SPIRAL NOTEBOOK BELONGING To[ _—| 
Barcode: E03826242 Location: ECR1 S6 06/28/2005 
b3 
b6 
b7C 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


FILE COPY 


07/13/05 | 


ICMIPRO1L 
15:26:53 FD-192 . Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: Source from which Property Acquired: 
12/16/1998 
b3 
Anticipated Disposition: Acquired By: Case Agent: b6 
| b7C 
b7E 
= ean tea of Property: Date Entered 
ITEMS FROM ROOM #4: 
(1) SIX 3.5" FLOPPIES; 
(2) ONE CD-R (TYPE 74) 
Barcode: B03841204 Location: ECR1 ° P48 12/17/1998 
b3 
b6 
b7C 
Case Number: Rie 


Owning Office: LOS ANGELES 


07/13/05 e : ICMIPRO1 
15:26:58 FD-192 Page 1 
Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
b3 
Anticipated Disposition: Acquired By: Case Agent: bé6 
b7C 
b7E 
i> rocmmaa (tal of Property: Date Entered 
ITEMS FROM ROOM #5: 
(1) THREE MISCELLANEOUS NOTEBOOKS WITH DOCUMENTATION AND 
MANUALS ; 
(2) ONE FORBES MAGAZINE, 11/16/98 
Barcode: E03841208 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7C 
b7E 
Case Number: 


Owning Office: LOS ANGELES 


07/13/05 ICMIPROL 
15:27:03 FD-192 Page 1 


Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
| b3 
| ; b6 
Anticipated Disposition: accuizes au Case aden oe 
Deeceepsnon of Property: Date Entered 
ITEMS FROM ROOM #5: 
(1) MISCELLANEOUS MANUALS AND DOCUMENTS; 
(2) ONE FORBES MAGAZINE 
Barcode: E03841205 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7C 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


07/13/05 | 


ICMIPROL 
15:27:06 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 

Date Property Acquired: Source from which Property Acquired: 

b3 

12/16/1998 b6 

b7C 

b7E 


Anticipated Disposition: Acauizec a Case —— 
sae a of Property: Date Entered 


ITEMS FROM ROOM #5: 
(1) ONE CREDIT CARD SCANNER; 
(2) VERIPHONE CREDIT CARD AUTHORIZATION EQUIPMENT; 
(3) THREE TELEPHONE COMPANY SERVICE PHONES 


Barcode: E03841206 Location: ECR1 P48 12/17/1998 


Case Number: 
Owning Office: LOS ANGELES 


07/13/05 ICMIPRO1 


15:44:47 FD-192 Page 1 
Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: Source from which Property Acquired: 


12/16/1998 
Anticipated Disposition: neguense = Case — 
Description of Property: Date Entered 
— bs 
b6 
ITEMS FROM ROOM #4: b7C 
(1) ONE SHARP WIZARD 512KB b7E 
(2) ONE TOSHIBA SATELLITE, SERIAL # 
Barcode: E03841207 Location: ECRL P48 12/17/1998 


b3 
b6 
b7c 
bTE 


Case Number: 
Owning Office: LOS ANGELES 


07/13/05 


ICMIPROL 
15:44:51 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: Source from which Property Acquired: 
b3 
12/16/1998 b6 
b7C 
b7E 
Anticipated Disposition: a = Case i 
= (Sa of Property: Date Entered 
ONE FOLDER WITH HACKING STATUTES ON PAPER (FROM ROOM #5) 
Barcode: E03841209 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7C 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


fin re agst 
! Py Dy gas 

tli de Hy ou 

\! Epecnta dbs 8 ed oS : 


07/13/05 ICMIPRO1L 
15:44:54 FD-192 Page 1 
Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: Source from which Property Acquired: 


12/16/1998 
Anticipated Disposition: noqulzed Bye Case Agent 
i cms (a of Property: Date Entered 
b3 

ITEMS FROM ROOM #6 (BEDROOM) : b6 

(1) ONE BOOK "THE FUGITIVE CENME"; b7C 
(2) ONE BOOK "THE WATCHMAN"; b7E 
(3) ONE BOOK "LINUX UNLEASHED"; 

(4) ONE BOOK "WINDOWS NT SECURITY GUIDE"; 

(5) ONE CARDBOARD POSTER [____] SILLY HACKER TYPE"; 

(6) ONE CARDBOARD POSTER "THE POWER OF 

(7) ONE "COMPUTER SECURITY BOOK"; 

(8) ONE BOOK "ART OF DECEPTION"; 

(9) DEF CON 6.0 PASS WITH NAME ; 

(10) ONE LINUX INTERNET ARCHIVES CD; 

(11) ONE VIDEO "HACKERS" 

Barcode: E03841210 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7Cc 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


07/13/05 : ; 


TCMIPRO1 
15:44:58 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: 
12/16/1998 
a ee ee ee 
Anticipated Disposition: Acquired By: Case Agent: b6 
b7E 
cS fs of Property: Date Entered 
ITEMS FROM ROOM #9: 
(1) ONE ARTIST BOOK; 
(2) ONE KEY RING 
(3) THREE JOURNALS; 
(4) SIX CYALUME LIGHT STICKS; 
(5) EIGHT PACKETS LABELED INFRARED; 
(6) ONE FINGERLIGHT; 
(7) TWO CYALUME LIGHTSHARP; 
(8) ONE ROLL DEFENSE CRIMINAL INVESTIGATION SERVICE 
EVIDENCE TAPE; 
(9) TWO WHITE BINDERS WITH DOCUMENTS (ROOM #11); 
(10) ONE BLACK BINDER WITH DOCUMENTS (ROOM #11); 
(11) FOUR NEWSPAPERS 
Barcode: E03841211 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7c 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


07/13/05 ICMIPRO1L 
15:45:02 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: Source from which Property Acquired: 
b3 
12/16/1998 bé 
b7c 
b7E 


Anticipated Disposition: pees — Case ore 


yp of Property: 


ITEMS FROM ROOMS #9, 10, 11: 


Date Entered 


(1) ONE ADDRESS BOOK; 
(2) ONE BROWN LEATHER BOOK OF POETRY AND OTHER WRITINGS; 
(3) ONE BLACK AND RED EMBROIDERED PATCH WITH THE WORD 
"SECURITY" IN RED; 
(4) ONE BOOK TITLED "HOW TO RECOGNIZE AND AVOID SCAMS, 
SWINDLES AND RIP-OFFS"; 
(5) EIGHT BOOKS ON ELECTRONIC EAVESDROPPING; 
(6) FIVE BOOKS ON NEW IDENTITIES OR HOW TO DISAPPEAR; 
(7) EIGHT BOOKS ON "HOW TO" COMMIT SCAMS, CONS AND OTHER 
ILLEGAL ACTS; 
(8) FOUR BOOKS ON LAW ENFORCEMENT TACTICS; 
(9) SIX BOOKS ON MISCELLANEOUS INFO. ABOUT INTERNETS, BUGS, 
COMPUTERS, ETC. ; 
(10) TWO HACKER INFO. BOOKS; 
(11) ONE ESPIONAGE-COMPUTER TRACKING OF SPIES BOOK; 
(12) FOUR BOOKS OF NOTORIOUS HACKERS (THREE HARD-BOUND) ; 
(13) ONE CITIZEN’S FIGHTING GOVERNMENT BOOK 
Barcode: H03841212 Location: ECR1 P48 12/17/1998 
b3 
b6 
b7C 
Case Number: me 


Owning Office: 


LOS ANGELES 


10/28/05 @ @ ICMIPRO1 


.11:06:47 FD-192 , Page 1 


Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
b3 
b6 
Anticipated Disposition: Acquired Bu Case agent a 
ama of Property: Date Entered 
ONE BOX CONTAINING ONE NO NAME TOWER CPU FROM ROOM #4 
Barcode: E03755402 Location: ECR1 P48 12/17/1998 
Case Number: 

Owning Office: LOS ANGELES ne 
b6 
b7C 
b7E 


PILE COPY 


10/28/05 @ & ICMIPRO1 


eloes7 22 . FD-192 Page 1 


Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
. b3 
Anticipated Disposition: — = Case anes ae 
b7E 
i of Property: Date Entered 
ONE BOX CONTAINING ITEMS FROM ROOM #4: 
(1) ONE NO NAME CPU, NO SERIAL # (ITEM #2); 
(2) ONE CIRCUIT SELLER CPU, NO SERIAL # (ITEM #3) 
Barcode: E03755416 Location: ECR1 P32 a 12/17/1998 
Case Number: 
Owning Office: LOS ANGELES 
b3 
b6 
b7C 
b7E 


FILE COPY 


10/28/05 @ é ICMIPRO1 


ih 04227 FD-192 Page 1 
Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
Anticipated Disposition:_Ac wired By: Case Agent: b3 
| | b6 
b7C 
i ices Mel of Property: Date Entered b7E 


ONE BOX CONTAINING ONE HEWLETT PACKARD MODEL 712160, SERIAL 
(ITEM #6, FROM ROOM #4) 


Barcode: BH03755401 Location: ECR1 P48 12/17/1998 


Case Number: 
Owning Office: LOS ANGELES 


FILE COPY 


11/01/05 ad ® ICMIPRO1 
10:20:36 F FD-192 Page 1 


Title and Character of Case: 


NEW YORK TIMES 
HACKING FOR GIRLIES 


Date Property Acquired: 


12/16/1998 
Anticipated Disposition: —— =e Case = 
cama (ad of Property: Date Entered 
b3 
ONE ‘AINING ONE HEWLETT PACKARD MODEL 712160, SERIAL b6 
(ITEM #6, FROM ROOM #4) b7C 
bT7E 
Barcode: E03755401 Location: ECR1 P48 12/17/1998 
ONE BOX CONTAINING ITEMS FROM ROOM #4: 
(1) FUJITSU HARD DRIVE MPB3021AT, SERIAL [L.___| (ITEM 
#13) ; 
(2) SEAGATE HARD DRIVE ee le ee #14) ; 
(3) SEAGATE HARD DRIVE 24001720-001 (ITEM #15) ; 
(4) SEAGATE HARD DRIVE[___] (ITEM #16) 
Barcode: E03755412 Location: ECR1 P48 06/06/2000 
b3 
= i tes anes b6 
b7c 
bUE 


Case Number: 
Owning Office: LOS ANGELES 


FILE COPY 


=a @ . 
11/03/05 


ICMIPROL 
10:46:38 FD-192 Page 1 | 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: 
12/16/1998 
Anticipated Disposition: Acauixes ays Case — 
i reassess (alc of Property: Date Entered 
ONE BOX CONTAINING ITEMS FROM ROOM #4: Be 
(1) SUN SPARK 47B, SERIAL (ITEM #4) ; am | 


(2) sun [L_____] (ITEM #5); . 

(3) SPARC STATION VOYAGER, SERIAL ITEM #7); Bue 

(4) HEWLETT PACKARD CD-WRITER PLUS, SERIAL 
(ITEM #9); 

(5) 12 CDR‘'S AND 4 EMPTY CDR CASES (ITEM #10); 

(6) 7 CRD’S (ITEM #11); 

(7) 15 3 1/2 DISKS (ITEM #12); 

(8) THREE JAZ TAPES (ITEM #17); 

(9) ETHERNET 10 BASE THUB, SERIAL (ITEM #18) ; 

(10) MITSUMI KEYBOARD 50 (ITEM #19); ° 


(11) MISCELLANEOUS CHORDS AND WIRES 


Barcode: H03839406 Location: ECR1 B280 12/17/1998 
4 
b3 
eS wees on b6 
eas #3 b7C 
b7E 
Case Number: 


Owning Office: LOS ANGELES 


FILE COPY 


nS 


06/28/05 | : 


ICMIPRO1L 
16:42:52 FD-192 F Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRUIES 
Date Property Acquired: i i : 
12/16/1998 
Anticipated Disposition: = ee Case oe 
s ramcaaen of Property: Date Entered 
b3 
ONE BOX CONTAINING ITEMS FROM ROOM #6: ae 
(2) 3 1/2 FLOPPY DISK; 


(3) ZIP DRIVE eee SERIAL[ a 


(4) MOTHERBOARD 


(5) 20HRIZ EXTERNAL FAX MoDEM[ 


Barcode: H03731282 Location: ECRI B307 12/17/1998 


ONE BOX CONTAINING ITEMS FROM ROOM #6; 
(1) suN 3/60, SERIAL[ =i /50[ +t 


Barcode: E03826241 Location: ECR1 P48 06/28/2005 
b3 
b6 
b7C 

Case Number: Pie 


Owning Office: LOS ANGELES 


07/13/05 S » 


ICMIPROL 
15:50:15 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: 
12/16/1998 
a cece ea of Property: Date Entered 
b3 
ONE BOX CONTAINING ITEMS FROM ROOM #6: b6 


(2) 3 1/2 FLOPPY DISK; 


b7c 
(3) ZIP DRIVE WITH DISK INSIDE, SERIAL [ ae 
a 


(4) MOTHERBOARD 
(5) 20HRIZ EXTERNAL FAX MODEM 33600[ 


Barcode: E03841213 Location: ECR1 P48 12/17/1998 


ONE BOX CONTAINING ITEMS FROM ROOM #6; 
(1) sun 3/60, sertan[—_—sijo6/so[ | 


Barcode: E03826241 Location: ECR1 P164 06/28/2005 


b3 
b6 
b7c 
b7E 


Case Number: 
Owning Office: LOS ANGELES 


He tle - 


07/13/05 . B 


ICMIPRO1 
15:50:19 FD-192 Page 1 
Title and Character of Case: 
NEW YORK TIMES 
HACKING FOR GIRLIES 
Date Property Acquired: Source from which Property Acquired: 
12/16/1998 
b3 
Anticipated Disposition: Acquired By: Case Agent: b6 
b7E 
ese pace of Property: : Date Entered 
(1) ONE TOSHIBA 315CDS/SATELLITE sERiaL[ 
(2) ONE XIRCOM, SERIAL | 
Barcode: E03841214 Location: ECR1 P48 12/17/1998 
a4 
b3 
b6 
b7c 
bTUE 
Case Number: 


Owning Office: LOS ANGELES 


Complaint Form : 
FD-71 (Rev. 4-13-92) 


a 
a 


NOTE: Hand print names legibly; handwriting satisfactory | forsremainder. 
Indices: [XJ] Negative [] See below a 


Subject’s name_apc_aliase 


alia yy * Ct] of case 
UNSUB (S) ; “ Y 
aka HFG- HACKERS OR GIRLS; 


x VICTIM; Complainant TT Protect Sou: 


__ received 


CO Personal [J Telephonic Date.09/13/98 Time _ 2:300m 
Lee nae and telephone number 
ii20Avenue pt Americas, New York, NY 


a ’s DOB SSAN Race Sex 
M 
Scars, marks and other data 


Facts of complaint 


vg 
gel ee 
vi. 
gel‘ | 
sas nf 
nP 
A 


Complainant is the New 


York Times. C advised that UNSUBS known as H4CKING FOR G1RL13Z (HACKING |* 
FOR GIRLS) aka HFG had hacked www.nytimes.com at approximately 8 am. The 
The UNSUBS replaced the main web page with their own page that contained 
pornography. The New York Times fixed the page, but was subsequently 
hacked again. C advised that the web server had been down several hours. 
‘C advised that www.antionline.com had-a story about _the hack. 


addition, the UNSUBS sent a threatening email to 
reporter). 


b6 
In Ib7C 
(a NY TIMES 


OPENAOR BEKO SEN iC SE, 
ORIGIN_W cA y 
SUPV. : 


SA 


(Complaint received by) 


On October 24, 1997 Federal Bureau of Investigation (FBI) 
eee Gl = = Neo 


(source) who provided the following information regarding 
computer crimes (CITA) matters: 


Source advised that he had information relating to 


advised that 


Source further stated that 


Case ID {| Serial :[_ | 


Source 


Source suggested that SAL___|contact{_—_—+d 


regarding the incident because source has personal knowledge that b6 
b7C 
b7D 


Federal Bureau of Investigation (FBI) Special Agent (SA) 


Source provided the following information: (| 


On December 30, 1997L______] (source) was debriefed b7E 


b6 
b7C 
b7D 


Qa @ Page 1 


01/29/98 


WaS 


contacted at her home and place of employment located at . 
telephone number ive 
She was advised as to the identity of the b7C 


interviewing Agent and the nature of the interview. This 

follow-up contact was the result of a prior call made by[ | ® 

to the[ _————s|Federal Bureau of Investigation (FBI) Office | | 
on December 22, 1997. She voluntarily provided the following 

information: 


[Jwas born onf____ din 
[ss ‘Her Social Security Account Number is 
Her 


She resides at 
home telephone number is 


She's been 
Prior to that, she worked for 


Inf and others had their 
computer systems attacked by a hacker they believed that went by 


the name planted an E-mail bomb in her 
system. In i 
known as concerning her E-mail attack in 

was a computer hacker. His website included 
information on the latest E-mail bombs. sent_an E-mail to 
[__] requesting that he remove his website. also 


wanted information that she could use to protect her own website 
from future E-mail attacks. [started sending material to 
written by himself and another hacker who went by the 
handle[_____] The information| __]was sending toL__] 
dealt with vulnerabilities of computer systems to E-mail attacks. 
At that time, was a member of a hacker group known as 
was also a member of[ and 


a e e 


Sometime after February of 1997,[____]was._ informed 


that was going to release a major denial of service b3 
computer program into the Internet. advised he was going b6 
to allow the program to be downloaded at the noe 


Case ID | Serial | | 


that the attack was eminent. 
convinced 


known as not to release the computer program into the 
Internet. He could potentially go to prison if caught. 


[ has been associated with[ in their 


efforts to combat the growing problem of hacker crimes. 


He currently lives in 
His telephone number is 
have been threatened by hackers that view him as a 


threat. 


In the early summer of 1997, 


at the 
annual Defcon conference in Las Vegas, Nevada. Defcon is an 
annual hacker convention. The conference was held on July 18, 
19, and 20, 1997. 


On July 18, 1997, 


was Known in the Cyber world as—____J and 
was known as[___| On July 19, 
1997, | had Tunch with[ | where they discussed hacker 
crimes and other related issues. [| believed that she had 
convinced[__]to turn away from the world of hacking and 
instead to work with her in getting others to change as well. 
During this meeting,[__| He ae them together. 
[_|believes that it was at this convention that 
away from SSSSSSS—sd ab Sco Terre that 
member of another hacker group known as 
time, was residing in 


It is believed that the New Order 
launched many of their computer attacks from an ISP known_as 
[id The owner of sd is either 
[jor[ sts believed that also during this 
convention the New Order and Global Chaos became allies and 
decided to work together. [| met another individual by the 
name of who is also a friend ofL___land a 
member of 


Approximately a week after the convention,[ _] sent 
an E-mail to indicating that he was quitting his 
association with continued to give 


- Work QOpy ---- @ Page 


Internet Service Provider (ISP) Suceed.net which is located in 
Yuba City, California. Two weeks before Easter, 


2 


b6 
b7C 


b6 
b7¢ 


b6 
b7C 


ifformation tol___| conceg 
activities. 


bog other hackers and their 


On October 4, 1997, 
had quitl ass of 
unhappy with the direction that 
activities. During this period, 


was taking in their 
also discovered that 


publications posted in the Internet. Other activities of other 


b6 
b7C 


‘@ itty -—- 


hackers were also provided tol _———_J another well-known 
hacker, is a member of may know 


the identity of this hacker. According to Was 
working with 


a website known as Showdown.org in the 
summer Of 1997. The website was an encyclopedia of denial of 
service attacks which included the actual C code for the computer 
programs. The intention of the site was to provide information 
that could help or assist system administrators to develop a 
defense against these types of attacks. On October 4, 1997, 

wrote where he expressed his anger toward_her_and 
her_activities. In one message, he refers to her as 

It_was also during this time frame,[ _J and other 

members of began computer attacks 
against at his account During the 
attacks on October 4, 1997, at Succeed.net, assisted 

and her efforts to determine who specifically was 
‘conducting the attacks. 


On October 5, 1997, another attack was launched on 
Succeed.net. During the period of these attacks,[_____J E-mail] 
was also hacked into and messages were stolen. October 7, 1997, 
the Sacramento FBI office was contacted. Special Agent 

was contacted 
and given the details of the Succeed.net attacks. 
believes that both[ —————————————sconductted the attacks on 
Succeed.net from October 5, 1997, to October 22, 1997. An 
individual who might be able to verify this is 


does not get along with 

lives in and his phone number is 

However,[ not on good terms withL____] 
because he believes that she made false accusations to law 
enforcement against him. [__] secured Succeed.net so that the 
attackers could not access the system after October 22, 1997. 
[-_] believes these hackers decided_to attack Succeed.net's 
link to the Internet, Pacific Bell. [| has no direct 
evidence that the same hackers attacked Pacific Bell; however, 
the entire Santa Clara area experienced a shutdown between 
October 26 and October 30, 1997 due to attacks on the telephone 
system. She had heard Pacific Bell had to spend millions to fix 
damage that was done on their systems. 


L_] heard that moved tol ____Jaround 


He was previously working for 
He was recently transferred or 


@ Page 


b6 
b7Cc 


b6 
b7c 


b6 
b7C 


b6 
b7c 


* - réhired in He started 
in on approximat®ry A prior 
member of may have additional 
information on[ _Jand his activities with 
_ phone number is and his work phone b6 
: : ’ b7C 


is 


Shortly after arriving in 
[_Jattempted to recruit On 


. “Mm WorkinecCopy ---- @ Page 


December 4, 1997, met with[___Jand discussed their 
possible alliance. advised[____]told her 
attempted to recruit by 

also wanted to 


engage in computer criminal activities. At this time, 

knowing the identity off requested that during his 
meeting with[___] he attempt to obtain additional information 
concerning other hacking activities. [has advised that he 
was not the hacker of the Succeed.net attack, 


During this meeting, also brought along 


who belongs to a hacker group called The events of the 
December 4, 1997, meeting were provided to 


on 
December 18, 1997. also advised — 


his computer taken by the FBI. also believed 
thet Thad been set up by the members of Global Chaos_and 


- the New Order because of his involvement with and[ | 
[| currently lives in His telephone 
number ist id could also be contacted at[ | 


telephone number 


On December 19, 1997,[ | contacted{ at his 


told her that he had 


home. 


He also 
advised that he had a computer account at However, he did 
not use it. is on his personal computer. 


last contact with 


has spoken to 
[J was on. December 18, 1997. 


She believes that is heading up many of these attacks 
against these two individuals because of their assistance to her. 
She also believes that possibly a sniffer was set up at 


which would enable them to obtain 
password at his[_ account and conduct many 


attacks against[ _|to make it look as if was conducting 


them. 


4 


b6 
b7Cc 


b6 
b7Cc 


b6 
b7C 


ark 


H gos -- & Page 1 


| 02/19/98 


was contacted at the restaurant 
TGI Friday located near the (Or 
He was advised as to the identities of the interviewing Agents 
and the nature of the interview. He voluntarily provided the 
following information: b6 
; b7c 


awhite male, was born on[. sd in 


His Social Security Account Number is 


He resides at 
His home telephone number is His work 


telephone number at is He will end his 
employment. with on[ ise has been 


b6 


[_|met[ several years ago on the ras 


Internet. L_____]posted technical articles dealing with various 
areas in the computer field. [would review some of these 
articles and point out technical errors that had made in 
her articles. [ __—| first association with also 
occurred several years ago. [___Joffered[___| his computer 


to host{ | website. 


Approximately six months to a year = a 
falling out with[__ concerning his website. was a 
experiencing technical problems on his server and as a result had | b6 
to shut down his computer for some time. [ _|blamed[(___] b7C 
for the problems and accused[___ of intentionally keeping his gis 


website down. In October of 1997, an ISP in the northern 
California area, succeed.net, was attacked and shutdown by 
unknown hackers. and blamed 

and for the attacks. 


advised that approximately one to two weeks 
before the October 1997 succeed.net attack, he contacted another 
hacker on Internet Relay Chat (IRC) who went by the handle 
laimed that he/she had actually gained access to 
account at succeed.net. The next day after his chat - 


_ segsion with| db tamed for 1? 
attack on[__——_—website™™Some of the details of the att 


aon 


were provided to by 

and His | 
understanding of the attack is that the hacker removed the 
directories or RMd the system. [ __Joffered to help 


Case ID | | Serial {| 


; - @ tsa --- @ 


find the hacker. To date,[_Jof succeed.net has not been 
jdenti fied. 


advised that he attended the annual Defcon 
Convention in Las Vegas, Nevada. It was during this convention 
in July 1997, where[____]met{[_ | believed that 
[__Jand[__|were good friends at one time. [__] denied 
any involvement with the succeed.net attack. believed 
that[ | who is a left the group 
after the Defcon V Convention in July 1997. believed that 


[| who is and had a 


falling out. also met 
[_] also known as at Defcon V. 


| Loved to the[ area on 
His primary access to the Internet is through 


a dial-up at work. Approximately three weeks ago, he also gained 
access to the Internet from a friend's account at comsite.net. 


During the first week of December 1997,[____] met 
the night before[__—_—had his computer seized 
Federal Bureau of Investigation (FBI). 
attended the meeting with 
had contacted[ __Jon TRC sometime earlier 
and wanted to meet with [| They met at 
and discussed various computer-related issues. 
concerned that University officials were watching him. 
was concerned that he was going to be caught by Universit 
officials for accessing the University computer ste, [I 
did not know what University he was referring to. 
admitted to[ | that he was “playing around on the University 
system." [ __|believed that playing around on the University 
system in hacker terminology meant that he had gained access to 
the University computer system. The next day, the FBI seized 
computer at the University. The next day, the FBI 


ee eect at the University. [-____ladvised 
that was a member off but did not know when 


he left. 


[| contacted 


his computer seized. 
help. last contacted 
weeks ago. gave 
computer in so that could have access to e-mail. 
The account, which was named was provided tol 
approximately three weeks ago. The account can be found on the 
machineL_ ibe lieve that 


several times after he had 
asked for money and for legal 

on IRC approximately three 
an account at his 


2 


b6 
b7¢ 


b6 
b7C 


b6 
b7Cc 


b6 


. b7e 


[and Jhave becqyyins this account _to illegally 


access his password file ons computer in There a 
approximately twenty users on the computer. 


advised that has been 


Furthermore, 
involved with 


Someone who might be able to provide 
additional information concerning this issue is a past associate 
off who now resides in 


b6 
b7Cc 


was a hacker at one time and now lives in 

also known as[_| is 

[___] Currently he speaks to various government and Air Force 

installations about the computer field. currently 

believes[ | lives in 

area. Dis.org is a organization for 

The organization is primarily a means to get together with others 
within the Internet. The New Order is a hacker group. 

advised that and they are in two 

states. Technophoria is another hacker group. 
did not know who went by the handle 


a hacker, apparently likes to edit websites. [___] 
likes to use computers from 


attacks. 


has heard of 


believed that 
backed out of his association with sometime ago. He did 
not know of anyone that would want to threaten him 


However, he had heard that [_____]had been harassed in the 
past. 


[_| who has the account lives 
someplace in the area. is a 
member of He was not sure which 
organization he belonged to. 


follows: 
that he did create and post on the Internet 


Some of the handles that{ | goes by are as 
Po acknowledged 


also advised 


that he created and posted on the Internet 


[__] advised that he had sent e-mails to[ | 


ce to her as aL_____] believes 
that will do just about anything to get information for 


provided the interviewing 
Agent with hard copies and disk copies of various e-mail 
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b6 
b7C 


b6 
b7Cc 


b7C 


b6 
b7C 


+ exchanges and computer —e his contacts with 
"and They are retatmed for evidentiary purposes. — 


b6 


w 


we - 


From: [od 
To: 
Date: Sunday, September 13, 1998 7:54 PM 


Page 1 of 2 


Subject: Fwd: this was sent tol__ this morning while these guys still | 


9/14/98 


eee aN 
pal tye erororey 


mem 


P acenseaitl 
anscemee MOS 


Sent By: FBI; 703 762 3446; Sep-15-98 9:56PM; 


en) 


Federal Bureau of Investigation 
WASHINGTON FIELD OFFICE 
NORTHERN VIRGINIA RESIDENT AGENCY 


NATIONAL COMPUTER CRIME SQUAD 
7799 LEESBURG PIKE 
FALLS CHURCH VA, 22043 
Fax NumBeER: 703-762-3446 


To: 
Date: -9/tS/98 
FROM: 


PRECEDENCE: . Kavtwe 

CLASSIFICATION: UANNCLAS 

NUMBER OF PAGES INCLUDING THIS COVER PAGE: z 
Fax Number: (212) 38¢-—4LL0 

SUBJECT: 


- Notes: Me 


ond barwstad Load 


2 


Z « fe, feo a Pe ae 


ee en ee 


APPROVEO BY: SUPERVISORY SPECIAL Ace] | 


Page 1/2 


b6 
b7C 


b3 
b6 
b7Cc 
b7D 
b7E 


eae 


Sent By: FBI; 703 762 3446; Sep-15-98 3:56PM; Page 2/2 


t ea og ® 


FD-302 (Rev. 10-6-9$} 


os oe 
FEDERAL BUREAU OF INVESTIGATION 


Dare of transcription 09/15/98 


A source, who is in a position to testify, provided the 
following information: 


b6 
b7C 
b7D 
tavestigation on 09/14/98 at USA b3 
b6 
. b7D 
by SA bT7E 
This dacument contains neither reenmmendations nor conclusions of the FBI. Itoy the property of the FB? and is loaned wm your agency; 
it and its contents are nor to be distributed outside your agency. 


De 
poner Hacked - Computer Security - Hacking anQ@kers - AntiOnline @ http://www.antionline.com/SpecialReports/nytimes/ 


3) 


LIMITED TIME OFFER | 


b6 
b7c 


"A Rick's Cafe in the Casablanca world of hacking." - ABC News - 


AntiOnline's Coverage Of 
The NyTimes Hack 


g 
3 


pmeprtinane wicket gabe! toe Jeste frantevnane 
ae 0 NMR en ate SNe a 


4 Subscribe! 
Tesneramence ts ms 


© Archive Of The Hacked NyTimes Website (www.nytimes.com) 


Here's the notification AntiOnline got a few weeks ago from the HFG 
about some other hacks they did: 


HI THERE, | 
YOU R3ALLY NEED TO VISIT MY WEB SITE. SEEMS THOSE 

DAMN HACKERS DID IT AGAIN. WHEN WILL THESE 

CORPORATIONS LEARN THAT SECURITY *IS* IMPORTANT?! 

WHILE WE MAY SEEM CHILDISH WITH OUR BANTER, LAME 

WITH OUR CAPS.. THE MESSAGE IS STILL THERE. SECURE 

YOUR CORPORATE SYSTEMS. IF WE CAN DOIT, INE 

CAN. OH.. HIDE YER DAUGHTERS CUZ WE WIL M b3 
TOO. 

HTTP://SPS. MOTOROLA.COM 

* AND* 

HTTP://WWW.MOT.CO.JP 

GO LOOK AND LAUGH. WE DID. 
HFG 


Past Hacks Include: 


* www jpl.nasa.gov 
® chili.rt66.com 
* sps.motorola.com 


2 0f2 


kers - AntiOnline © http:/Avww.antionline.com/SpecialReports/nytimes/ 
(1.8) 


¢ NyTimes Hacked - Computer Security - Hacking a 


-° www.mot.co.jp 

* www.elitehackers.org 

* classifieds.penthouse.com 
* www.mchammer.com 


Thanks to our friends at Walla! for a heads up on this one. 


Also, shout-outs to as well. 


As Always, Let Us Know What You Think! 


AntiQnline Is A Trademark Of John Vranesevich 
Content Is © AntiOuline. All Rights Reserved 


9/13/98, 156 PM 


b6 
b7c 
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_HFGOWNS Z2 ionli 
MAH DUMB AZZ pf s:icnine com archivesipages'www nytimes.com: 


rm) 


be tie : 7 
i a cc . i 
aaa = ae 


FIRST OFF, WE HAVE TO SAY.. WE OWN YER DUMB ASS. 
4ND R3MEMB3R, DUMB ASS 1S OFT3N CUTE 48S. AND WE LIKE CUTE ASS. 


S3COND, TH3R3 AR3 SO MANY LOS3RS H3R3, 1TZ HARD TO PICK WHICH 
TO INSULT THE MOST. 


S1NC3 WE AR3 NOW INTERN3T TERRORIST2, W3 FIGURE WE SHOULD DEMAND 
SOME RANSOM OR SOMETHING. SO, PAY US 104 GIRLIEZ, 6 BILLION IN 
N3WSPAP3R SUBSCRIIPTIONZ, AND MAYBE A PRINTING PR3SS OR SOM3THING. 
NOT LIK3 YOU GUYS KNOW WHAT FAIR JOURNALIZM IS ANYWAY. DUMB WHOR3Z. 


TH1Z ON3 IS FOR Y3W. 


W3 GOTTA START TH1S OUT RIGHT, SO HI[_______—sd 
W3 EXP3CT FRONT PAG3 L1K3 YOU PROMISED. $0 WHY BR3AK OUR AGR33M3NT 


AND T3LL THE WORLD WE AR3 WORKING TOG3THER ON THIS LITTL3 H4CK? 
DO YOU HAV3 NIGHTMAR3S ABOUT H3LP1ING 


B3CAUSE YER A_WORTHL3SS PI3CE OF SHIT. 
IMPRISON KNOWING THAT YOUR LI3S AND D3C3IT H3LP3D BRING DOWN 
THLS INJUST1C3? ALL SO YOU COULD MAK3 A F3W EXTRA BUCKS AND G3T IN B3D b3 
WITH | WHY NO ARTICL3S ON TH3 MOVI3 COMING OUT THAT FURTH3R b6 
BITCH. b7c 


AND YOU CRY ABOUT SOME HACK3R PRANK C 
AND QUIT CALLING Y3R P3T[__]A 'S3CURITY EXP3RT', H3 GO 
T0 BEGIN WITH, AND NOW, P30PL3 AR3 SAYING H3 HAD NO SKILLZ. IF S0, 
THAT M3ANS AN UNSKILLED HACK3R B3AT TH1S SO CALL3D SECURITY 3XP3RT. 


HAV3N'T H3ARD FROM YOU 1N A WHIL3[.____] OH! D1D SOM30N3 
OV3R TH3R3 FINALLY CATCH ON THAT YOU AR3 A CLU3L3SS MORON? W3LL, HFG 


INDUCTED A N3W M3MBER 1N YOUR HONOR. SAY H1 TO YOUR FRI3ND FROM 50 
LONG AGO. (R3AD THE HTML COMM3NTS IF YOU CAN'T GU3SS WHO THAT 12 MORON) 


NY-TIM3S N33DS TO HIRE SOME THIRD GRAD3RS. THAT WAY P30PL3 WOULD G3T 
BETTER AND MORE ACCURATE NEWS ARTICLES FOR A CHANG3. 


DEMONI23S HIM? 


9/13/98 1:52 PM 


lof4 


HFG OWNS MAH DUMB AZZ @ 


bi] » auionine.con/erciver/pagestvrrw aytines.com/ 


YOU MUST B3 TH3 N3W STAR AROUND TH3R3. YOU S33M TO HAV3 A CLU3 ABOUT A 


F3W THINGS. _ ONS P1i3C3 OF ADVIC3 THOUGH, CH3CK YOUR SOURC3S B3TT3R. 
YOU HAV3 QUOTED PR3T3ND HACK3RS 1N TH3 PAST. DOESN'T LOOK GOOD FOR YOU. 


| b6 
THiS Time,[_———S—s—S—S—~—SC ASKED US TO_HIT A _B1GG3R_AND MORE TRAFFICKED b7C 
SIT3. SH3 TOLD US TH3 OTHER DAY THATT ss CC™~—CSOCCCCCCCC;Ct;*#«é‘#“; 
1TZ AMAZING HOW SH3 SPINS THINGZ AROUND. H3R3 W3 THOUGHT SH3 WOULD G3T 

MAD AT US FOR BR3AKING OUR AGR33M3NT, BUT SH3 SAID “DON'T WORRY HFG, 
| NO ON3 WILL BELIEVE YOU SINCE YOU AR3 BLACKHAT HACK3RS. B3SID3Z, THIS 
| ADDS MORE MYST3RY AND SUSP3NCE FOR ME. CONTROV3RSY SELLZ!". OK. IF 


you s4y so. 


HFG 1Z NOW GOING INTO THE CIGAR BUSINESS T00. W3 WILL S3LL OUR OWN 


LIN3 OF DESIGNOR CIGARS, STARTING WITH THE[___——sdC1GAR". 17 b6 
HAS A FAIRLY DISTINCT TASTS. (AND W3 THOUGHT *W3* W3R3 KINKY!) b7c 
HFG N3WS: W3LP, THIS IZ OUR LAST HACK FOR A LITTL3 WH1L3. S1NC3 
UIT HIS JOB AT[____——=«diwH#3:«£Z HAVING TO WORK EXTRA 
HOURS AT TO 3NSUR3 A CAR33R_ THERE. 1Z STILL IN 
SOM3 M3X1CAN WHORE HOUSE, WHILE 1Z MISSING IN ACTION. 
DONT 3V3N ASK WH3R3~L___—diIZ! «=WH1L3 W3 TAK3 A VACATION, 
YOU GUYS CAN STILL BUILD ALT3RS AND SHRIN3S TO US. W3 KNOW YOU 
LOVE US. AND R3ST ASSUR3D, W3 W1LL B3 BACK SOON. PROM1S3! 
HFG PO3TRY FOR YOU: b6 
aahermeipubataeateg Nine ene wenn b7C 
wether you believe it or scoff 
we at HFG hate 
to the new writer 
we say “at least you're not a rat" 
for some_reason hates 
even when is the real big dick 
while is no beginner to crime 
is the one doing his time 
hanging here at new york times 
is the best place to sling our rhymes 
poor journalism these guys have the knack 
which explains the good security they lack 
on their women and their suns is 


next thing you know, we'll be looking for nuns 
in our short absence we leave you this thought 
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HFG OWNS MAH DUMB AZZ @ 


tt» sioatine.comarchivespageshvwwaytines.com/ 


at least the good fight was fought! 


HFG 1S PROUD TO OFFER OUR N3W S3CURITY TRAINING_S 
A PRINTING PR3SS N 9969.99 +TAX, 


CAN L3ARN HOW NOT TO SO _ 3ASILY. TOO GOOD TO B3 


TRUE ¥. 2 0 STOL3N 
FROM SYST3M IN .04 SECONDS. NOT BAD HUH? 


W3 AR3 TH3 GR3Y HAT ROBIN HOODS_ OF HACKING! 
W3 FEEL UP TH3 RICH, AND L1V3 FOR MORE! 


PL3ASE VISIT AND SUPPORT SITES WE DON'T OWN: 


bd FREE | [va DUMB WHORE?! 


® IF YoU CAN'T AFFORD OUR SEMINAR... 


© FIGHT THESE CRIMINALS 
® THE GOOD GUYS 


® THESE GUYS ROOL 


HFG '98 BABY ! 


H4CKING 4 GIRL13Z 


PS: OUR COMMENTS ARE MORE 'LEET THAN OUR TEXT. DOWNLOAD THE SOURCE 
TO THIS PAGE AND PONDER OUR W1ZD0M. 


PPS: Y3S!@#$ WE ARE BOR3D, QUIT ASKING US. 


PPPS: HFG WOULD LIKE TO GREET: HFG, 


b6 
on. anpD___ 


HFG, AND OUR DOG. ie 
PPPPS: HFG WOULD LIKE TO RIDICUL3: 

MASTERS OF DOWNLOADING, LEGIONS OF THE UNDERGROUND, 

ENFORCERS, [____] ASHTRAY LUMBERJACKS, ANTIONLINE.COM, 


H4G1S, INFOWAR.COM, ROOTSHELL.COM AND OTHER LAMERS. 


9/13/98 1:52 P. 


| 3 = 


a aie J = : 
HFG )WNS MAH DUMB AZZ @ iQ] + ionic con/arhives’pages/rurw nytimes.com 


PPPPPS: W3 D1G YOUR CRONTABZ! 


PPPPPPS:[___]SM3LLS LIKE HANDCUFFS. so DoEs[ sd b6 
b7C 


Contact us at owned@hfz.org 
Copyright 1997 1998 Y2K HFG 3NT3RPRI1Z3S. ALL RIGHTS PERVERSE. All LEFTS 


PRESERVED. : 
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Case ID #: ae 
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Title: Transmittal EC ees 


Synopsis: To forward| _|source paperwork to Squad C-37, New 
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Enclosures: One (1) copy of a source FD-302. 


Details: [_|re ests the enclosed source paperwork be 
forwarded to SA Squad C-37. 
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HFG \” HACKERS, FOR, GIRLIES ; 
NEWYORK TIMES seul 
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OO: NY 
OILS 

et a lead to deliver a court order inf | 
UNSUB (S) 


KA HFG -HACKERS FOR GIRLS 
NEW YORK TIMES - VICTIM 


Synopsis: To 


Previous Title: 


CITA; 
00: NY 
| Reference: Telephone call between sa[___ana sa[ on 
| 09/21/98. 
ures: 


OTHER Sealed pursuant to court order 


Details: On 09/13/98, The New York Times website was hacked by a 
group known as HFG - HACKERS FOR GIRLIES. The hackers defaced 


the website and caused the site to be taken down. The logs were b3 
erased, but have since been recovered. The logs_indicate that b6 
| the_hackers came from IP addresses belonging to an ISP b7c 


a ve 


at[ advised that 


a Federal Subpoena or Court Order would be r 
the user information or logs. 
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Complainant 7] Protect Source 
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Complainant’s DOB SAN Race Sex 
ae W M 
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REPLY FORM ~- INVESTIGATIVE INFORMATION SERVICES 


To help us better serve your investigative needs, please complete 
and return to: 


FBI, Butte Information Technology Center 
400 Main Street, Room #115 
Butte, Montana 59701 


BUTTE ITC RE : 782 ~UCEN: b3 

ANALYST: SUBJECT: b6 

b7c 

Was the information provided helpful to your investigation? 0 YES O wo bIE 
If NO, please let us know how we could be more helpful to your 


investigation: 


ACCOMPLISHMENT (S) resulting from information: 
PERSON(S): (Enter total number applicable to each of the following) 


FBI Fugitive(s) Arrested: QO FBI OF Local Date_ 

(Forward photo of Fugitive arrested with this Reply form) 
Local Fugitive(s) Arrested: Ol FBI OO Local Date 

(Forward photo of Fugitive arrested with this Reply form) 
Subject (s) O Arrested 0 Located O Identified 
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Witness(es) 0) Located [] Identified 
New Witness(es) 01 Located O Identified 
BUSINESS (ES): (Enter total number applicable to each of the following) 
New Business(es) Identified 
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Financial Audit Trail(s) Enhanced 
ASSET(S): (Enter total number applicable to each of the following) 

(TYPES: C = CASH R= REAL PROPERTY P = PERSONAL PROPERTY) 
Asset(s) Located © Identified [VALUE: TYPE: } 
Asset(s) Subject to Seizgure/Forfeiture [VALUE: TYPE: ) 
Potential Economic Loss Prevented (VALUE: TYPE: } 
OTHER: (Enter total number applicable to each of the following) 

New Case(s) Initiated New Lead(s) Generated 
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1 - Case File 
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Form No. USA-33s-224-Grand Jury Subpoens Duces Tecuro 
nnn TN I, 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK. 


GREETINGS: 


We COMMAND YOU that all business and excuses being laid aside. you appear and attend before the GRAND 
INQUEST of the body of the people of the United States of America for the Southern District of New York. at 


District Court to ds held at Room/¥O#_in the gh ot 
Manhatten. City of New York. on th day of| to testify 
and give evidence in regerd to an alle: of 


(te WSC. £ Az4, it¢7s 


And for failure to attend and produce the said documents you will be deemed guilty of contempt af Court and 
Gable to penalties of law. 


Southern District of New York. Clerk. 


NOTE: REPORT AT ROOM 767. In order to secure your witness fees and mileage. it is neceasary thet you 
retain this Subpoena and present the same at the United States Attomey’s Office, Room 767, upon each day on 
which you attend Court as 0 witness. 


Room Cy ff 
Telephone: One St. Andrew's Plaza 
New York, New York 10007 
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Number NEW YORK TIMES“ERECTRONIC 
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___]. The New, Yorls bé 
Times, 112 2 f ,. NE YO! k, } ew York 10036, b7c 
telephone d Date ixtl wasn’ 


of the Federal 


contacted by Special Agént 
Bureau of Investigation (FBI). After being advised of the 
identity of the interviewing eyene | I eeowided the following 
information: 


stated that on Sunday, September 13, 1998, he b6 
in Princeton, NJ when he was paged by b7c 
of The New York Times, at about 

8:30 AM. advised that The New York Times World 

Wide Web (WWW) page had been hacked. The New York Times Web page 

has the (WWW) address of www nytimes.com. [___] stated that 

upon being paged byl J he“in“t turn paged other people at The 

New York Times. He then logged onto The New York Times server to 

see what damage had been done by the hacker(s). He stated that Kh 

he did this about 9:00 or 9:30 AM. ; 


was visitin 


Upon logging in,[~_____] stated that he began looking at b3 
the log files, in particular the last logs. He said that he did b6 
Pie did not now bre 
what this process was. Shortly after checking this log, [J 

hack that stated “HFG 


received a message from th 


to 
ysica oused the hacked computer, and power 
it down. The computer was located in New York City. 

stated that the web page server was brought down between 10:00 


and 10:45 AM. 


[| concluded that she would be available for 
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- : meer fae GLE oN EW b6 
York Time “the” Ameficas, Néw ‘YORE, NY 10036, b7c 


age me hs ae 


telephony’ ZZ | was contacted on Sept miber 24" 1998. 


provided the following: 


1) 3 %" floppy diskette labe » ORK TIMES, 
9/24/98, e-mail attachments to ; 


The floppy diskette contains two files, xl and yl. 
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Former 
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(if applicable) 
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Residence 


Business 


Former f : 
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The following investigation was conducted by sat 


[—sidon 10/02/98 at New York, New York: 


hone call to 
revealed that 


voicemail system, phone 


had extension[____} 
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> b6 
b7C 
b6 
b7C 
ae ee eee 
developed a cyfsh on| sf but] _—s {did not feel the same way. 
vantesc marry| ——._: [got upset when[____] started 
dating soméone else that she met on IRC. webpage 
was hacked by and his associates. [__] 
and her pérsonal information (SS#, DOB, 
address, phone #, etc..) was put on the website. [| credit 
card was used to make numerous fraudulent conference calls and 
someone attempted to break into her house. is _a_member of 
a! and his website is 
has logs of the hack and agreed to send them to the agents. 
[_|believed that one of associates bé 
b7C 


approximately 
emer on the hack. workéd at 


logs show the,sHack originated from 


fi 


TE [ 
may have been involved is known to have made 


thousands of flacked phione calls using illegally obtained credit 
cards. 5 
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